Skip to content

Commit 15b9a0e

Browse files
BenjinBenjin
committed
trying docker
1 parent 7634c8a commit 15b9a0e

1 file changed

Lines changed: 48 additions & 113 deletions

File tree

‎.github/workflows/pr-check.yml‎

Lines changed: 48 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -1,162 +1,97 @@
11
name: pr-check
22

3-
# Note: If you need to make changes to this file, please use a branch off the main branch instead of a fork.
4-
# The pull_request target from a forked repo will not have access to the secrets needed for this workflow.
3+
# Tests PR code against a local SQL Server container so no Azure credentials are required.
4+
# This workflow uses the pull_request trigger (not pull_request_target), so fork PRs run
5+
# with no secrets and no elevated permissions.
56

67
on:
7-
pull_request_target:
88
pull_request:
9-
paths:
10-
- '.github/workflows/pr-check.yml'
119

1210
permissions: {}
1311

1412
jobs:
15-
# Build job that safely builds artifacts from PR code without access to secrets
16-
build:
17-
environment: Automation test # Require approval before running the action
18-
runs-on: ${{ matrix.os }}
13+
test:
14+
runs-on: ubuntu-latest
1915
permissions:
2016
contents: read
21-
strategy:
22-
matrix:
23-
os: [windows-latest, ubuntu-latest]
24-
steps:
25-
- name: Checkout from PR branch
26-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27-
with:
28-
repository: ${{ github.event.pull_request.head.repo.full_name }}
29-
ref: ${{ github.event.pull_request.head.sha }}
30-
31-
- name: Verify package-lock.json exists
32-
run: |
33-
if (!(Test-Path package-lock.json)) {
34-
Write-Error "package-lock.json not found. Please commit package-lock.json to ensure reproducible builds."
35-
exit 1
36-
}
37-
shell: pwsh
38-
39-
- name: Check if package-lock.json was modified
40-
run: |
41-
# Check git log to see if package-lock.json was modified in this PR
42-
git fetch origin ${{ github.base_ref }} --depth=1
43-
$changedFiles = git diff --name-only origin/${{ github.base_ref }}...HEAD
44-
45-
if ($changedFiles -match "package-lock.json") {
46-
Write-Warning "⚠️ package-lock.json has been modified in this PR."
47-
Write-Warning "This requires manual review to ensure no malicious dependencies were added."
48-
Write-Warning "Reviewers: Please carefully examine the dependency changes before approving."
49-
} else {
50-
Write-Host "✓ package-lock.json unchanged - no new dependencies" -ForegroundColor Green
51-
}
52-
shell: pwsh
53-
continue-on-error: true
54-
55-
- name: Verify package.json integrity
56-
run: |
57-
# Check for suspicious scripts that could be used for attacks
58-
$packageJson = Get-Content package.json | ConvertFrom-Json
59-
$suspiciousScripts = @('preinstall', 'postinstall', 'prepack', 'postpack')
60-
61-
foreach ($script in $suspiciousScripts) {
62-
if ($packageJson.scripts.$script) {
63-
Write-Warning "⚠️ Found lifecycle script '$script' in package.json"
64-
Write-Warning "Script content: $($packageJson.scripts.$script)"
65-
Write-Warning "Reviewers: Please verify this script is legitimate"
66-
}
67-
}
68-
shell: pwsh
69-
70-
- name: Installing node_modules with ci (uses lockfile, ignores scripts)
71-
run: npm ci --ignore-scripts
72-
73-
- name: Audit dependencies for known vulnerabilities
74-
run: npm audit --audit-level=high
75-
continue-on-error: true
76-
77-
- name: Build GitHub Action
78-
run: npm run build
79-
80-
- name: Upload build artifact
81-
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
82-
with:
83-
name: action-build-${{ matrix.os }}
84-
path: |
85-
lib/
86-
node_modules/
87-
action.yml
88-
package.json
89-
package-lock.json
90-
retention-days: 1
91-
92-
# Deploy job that uses the built artifacts and has access to secrets
93-
deploy:
94-
needs: build
95-
environment: Automation test # this environment requires approval before running the action
96-
runs-on: ${{ matrix.os }}
97-
permissions:
9817
checks: write
99-
id-token: write # This is needed for Azure login with OIDC
100-
continue-on-error: true
101-
strategy:
102-
matrix:
103-
os: [windows-latest, ubuntu-latest]
18+
19+
services:
20+
sqlserver:
21+
image: mcr.microsoft.com/mssql/server:2022-latest
22+
env:
23+
ACCEPT_EULA: Y
24+
# Bootstrap password - rotated to a random value in the first step
25+
MSSQL_SA_PASSWORD: Bootstrap1!
26+
ports:
27+
- 1433:1433
28+
options: >-
29+
--health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Bootstrap1!' -C -Q 'SELECT 1' || exit 1"
30+
--health-interval 10s
31+
--health-timeout 5s
32+
--health-retries 10
10433
10534
env:
106-
TEST_DB: 'SqlActionTest-${{ matrix.os }}'
35+
TEST_DB: SqlActionTest
36+
# Password is appended after rotation in the first step; composed into connection strings below
37+
BASE_CS: 'Server=localhost;User ID=sa;TrustServerCertificate=True;'
10738

10839
steps:
109-
- name: Checkout base repository (for test data only)
110-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
40+
- name: Rotate SA password
41+
run: |
42+
SA_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=')Aa1!"
43+
/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Bootstrap1!' -C \
44+
-Q "ALTER LOGIN sa WITH PASSWORD='${SA_PASSWORD}'"
45+
echo "SA_PASSWORD=${SA_PASSWORD}" >> "$GITHUB_ENV"
11146
112-
- name: Download build artifact
113-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
47+
- name: Checkout PR
48+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
11449
with:
115-
name: action-build-${{ matrix.os }}
116-
path: .
50+
ref: ${{ github.event.pull_request.head.sha }}
51+
52+
53+
- name: Build GitHub Action
54+
run: npm ci --ignore-scripts && npm run build
11755

11856
- name: Setup .NET
11957
uses: actions/setup-dotnet@v4
12058
with:
12159
dotnet-version: '8.x'
122-
- name: Install SqlPackage (Linux only)
123-
if: runner.os == 'Linux'
124-
run: dotnet tool install -g microsoft.sqlpackage
12560

126-
- name: Azure Login
127-
uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
128-
with:
129-
client-id: ${{ secrets.AZURE_CLIENT_ID }}
130-
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
131-
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
61+
- name: Install SqlPackage
62+
run: dotnet tool install -g microsoft.sqlpackage
13263

133-
# Deploy a DACPAC with only a table to server
64+
# Deploy a DACPAC with only a table to server (sqlpackage creates the DB if needed)
13465
- name: Test DACPAC Action
13566
uses: ./
13667
with:
137-
connection-string: 'Server=${{ secrets.TEST_SERVER }};Initial Catalog=${{ env.TEST_DB }};Authentication=Active Directory Default;'
68+
connection-string: '${{ env.BASE_CS }}Password=${{ env.SA_PASSWORD }};Initial Catalog=${{ env.TEST_DB }};'
13869
path: ./__testdata__/sql-action.dacpac
13970
action: 'publish'
71+
skip-firewall-check: true
14072

14173
# Build and publish sqlproj that should create a new view
14274
- name: Test Build and Publish
14375
uses: ./
14476
with:
145-
connection-string: 'Server=${{ secrets.TEST_SERVER }};Initial Catalog=${{ env.TEST_DB }};Authentication=Active Directory Default;'
77+
connection-string: '${{ env.BASE_CS }}Password=${{ env.SA_PASSWORD }};Initial Catalog=${{ env.TEST_DB }};'
14678
path: ./__testdata__/TestProject/sql-action.sqlproj
14779
action: 'publish'
80+
skip-firewall-check: true
14881

14982
# Execute testsql.sql via script action on server
15083
- name: Test SQL Action
15184
uses: ./
15285
with:
153-
connection-string: 'Server=${{ secrets.TEST_SERVER }};Initial Catalog=${{ env.TEST_DB }};Authentication=Active Directory Default;'
86+
connection-string: '${{ env.BASE_CS }}Password=${{ env.SA_PASSWORD }};Initial Catalog=${{ env.TEST_DB }};'
15487
path: ./__testdata__/testsql.sql
88+
skip-firewall-check: true
15589

15690
- name: Cleanup Test Database
15791
if: always()
15892
uses: ./
159-
with:
160-
connection-string: 'Server=${{ secrets.TEST_SERVER }};Initial Catalog=master;Authentication=Active Directory Default;'
93+
with:
94+
connection-string: '${{ env.BASE_CS }}Password=${{ env.SA_PASSWORD }};Initial Catalog=master;'
16195
path: ./__testdata__/cleanup.sql
16296
arguments: '-v DbName="${{ env.TEST_DB }}"'
97+
skip-firewall-check: true

0 commit comments

Comments
 (0)